| { |
| "schema_version": "1.4.0", |
| "id": "GHSA-w4xh-w33p-4v29", |
| "modified": "2023-02-08T00:28:40Z", |
| "published": "2022-05-14T00:55:16Z", |
| "aliases": [ |
| "CVE-2017-17831" |
| ], |
| "summary": "GitHub Git LFS Improper Input Validation vulnerability", |
| "details": "GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a `url =` line in a `.lfsconfig` file within a repository.", |
| "affected": [ |
| { |
| "package": { |
| "ecosystem": "Go", |
| "name": "github.com/git-lfs/git-lfs/lfsapi" |
| }, |
| "ranges": [ |
| { |
| "type": "ECOSYSTEM", |
| "events": [ |
| { |
| "introduced": "0" |
| }, |
| { |
| "fixed": "2.1.1-0.20170519163204-f913f5f9c7c6" |
| } |
| ] |
| } |
| ] |
| }, |
| { |
| "package": { |
| "ecosystem": "Go", |
| "name": "github.com/git-lfs/git-lfs" |
| }, |
| "ranges": [ |
| { |
| "type": "ECOSYSTEM", |
| "events": [ |
| { |
| "introduced": "0" |
| }, |
| { |
| "fixed": "2.1.1-0.20170519163204-f913f5f9c7c6" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "severity": [ |
| { |
| "type": "CVSS_V3", |
| "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" |
| } |
| ], |
| "references": [ |
| { |
| "type": "ADVISORY", |
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17831" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/git-lfs/git-lfs/pull/2241" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/git-lfs/git-lfs/pull/2242" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/git-lfs/git-lfs/commit/f913f5f9c7c6d1301785fdf9884a2942d59cdf19" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html" |
| }, |
| { |
| "type": "PACKAGE", |
| "url": "https://github.com/git-lfs/git-lfs" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://pkg.go.dev/vuln/GO-2021-0073" |
| }, |
| { |
| "type": "WEB", |
| "url": "https://web.archive.org/web/20200227131639/http://www.securityfocus.com/bid/102926" |
| }, |
| { |
| "type": "WEB", |
| "url": "http://blog.recurity-labs.com/2017-08-10/scm-vulns" |
| }, |
| { |
| "type": "WEB", |
| "url": "http://www.securityfocus.com/bid/102926" |
| } |
| ], |
| "database_specific": { |
| "cwe_ids": [ |
| "CWE-20" |
| ], |
| "github_reviewed": true, |
| "github_reviewed_at": "2023-02-08T00:28:40Z", |
| "nvd_published_at": "2017-12-21T06:29:00Z", |
| "severity": "HIGH" |
| } |
| } |
